The door was remote desktop. It usually is.
A dental group in San Antonio was breached through its remote desktop web services infrastructure, and up to 30,000 Texas residents may be affected. The specific entry point is the part worth reading about, because it is the same door standing open at a large number of small practices right now, and it is one a non-technical owner can get checked in an afternoon.
What happened
Soniva Dental Care, a dental group headquartered in San Antonio, Texas, discovered unauthorized remote access sessions on May 26, 2026. According to HIPAA Journal, the intrusion came through the group's remote desktop web services infrastructure. An IT support company performed the forensics.
A ransomware-as-a-service group calling itself TheGentlemen claimed responsibility in early June 2026. Up to 30,000 Texas residents were potentially affected across six practices operating under the group: Agave Dental Floresville, Allwyn Dental, Azle Smiles, Kashi Dental, Mysa Dental, and Wilson Dental.
The exposed data included names, addresses, dates of birth, driver's license numbers, government-issued IDs, and medical information. The filing went to the Texas Attorney General. As of the HIPAA Journal report, the incident had not yet appeared on the HHS Office for Civil Rights breach portal. Dental practices have accounted for a steady share of healthcare breaches this year, as Becker's Dental Review has tracked.
Why remote desktop keeps being the door
Remote desktop web services let someone open a practice's desktop from a browser, anywhere. The technology is ordinary and often useful. The problem is how practices end up with it facing the public internet.
It usually arrives for a sensible reason. A vendor set it up so the doctor could check tomorrow's schedule from home. An imaging software representative needed remote access to install an update and asked for a port to be opened. An IT person who left two years ago configured it once and nobody has looked at it since. None of those decisions were reckless on the day they were made, and all of them tend to outlive the reason for them.
Here is what makes an internet-facing remote desktop endpoint different from almost every other kind of exposure. It is a login prompt facing the entire internet. It does not need to be found by anyone in particular, because it is scanned for continuously and automatically. Attackers can try credentials against it around the clock, from anywhere, and a practice that is not watching login activity has no reason to notice. Every other system in the office sits behind something. This one answers the door itself.
What actually closes it is a short list:
- No remote desktop or remote desktop web access reachable from the open internet.
- Remote access only through a VPN or a zero-trust broker, so the login prompt is never the first thing an attacker meets.
- Phishing-resistant multi-factor authentication on every remote path, not just the main one.
- Account lockout after repeated failed attempts, so credential guessing stops being free.
- Alerting on successful logins from new locations, because the dangerous login is the one that works.
Nothing on that list is exotic and none of it requires replacing a practice management system.
The part that costs more than the ransom
Ransom negotiation gets the attention. Notification is what consumes the following months.
The HIPAA Breach Notification Rule requires notification to HHS within 60 days of discovery for breaches affecting 500 or more individuals. Discovery here was May 26, 2026. Sixty days from that date is July 25, 2026. That arithmetic is worth sitting with, because a practice that discovers a problem on a Tuesday is already on a clock it did not choose, running while forensics are still incomplete and while the total affected count is still an estimate.
Texas adds its own obligation. Breaches affecting 250 or more Texas residents require notifying the Attorney General, a threshold far below the federal 500. A practice can be under a state duty well before it crosses the federal line.
The exposed fields matter here too. Driver's license numbers and government-issued IDs are precisely the elements that trigger state notification laws beyond HIPAA. A breach limited to appointment times is a different legal event from one that includes identity documents, and this one included identity documents.
Five things a practice can check this week
Each of these is one question to an IT provider, and each has a short answer if things are in order.
- Ask what is reachable from the public internet. The answer should be a short list, and a remote desktop service should not be on it.
- Ask whether remote access requires multi-factor authentication, and what kind. App-based or hardware-based, not SMS.
- Ask when a restore from backup was last tested end to end. Whether backups run is a different question from whether they restore.
- Ask who still has remote access from previous IT vendors or former staff. Old accounts are the ones nobody is watching.
- Ask where the written incident response plan is and who makes the notification call. Sixty days is not long to work that out from scratch.
Frequently asked questions
How did the Soniva Dental breach happen?
Through the group's remote desktop web services infrastructure. Unauthorized remote access sessions were detected on May 26, 2026, and an IT support company performed the forensics. A ransomware-as-a-service group calling itself TheGentlemen claimed responsibility in early June 2026.
How long does a dental practice have to report a breach?
The HIPAA Breach Notification Rule requires notification to HHS within 60 days of discovery for breaches affecting 500 or more individuals. Texas separately requires notifying the Attorney General for breaches affecting 250 or more Texas residents, a threshold far lower than the federal one.
What is the safest way to allow remote access to a dental practice network?
No remote desktop service reachable from the open internet. Access runs through a VPN or a zero-trust broker, every remote path carries phishing-resistant multi-factor authentication, accounts lock out after repeated failures, and successful logins from new locations raise an alert.
Closing
An incident like this one is not evidence that dental practices are careless. It is evidence that a common, useful piece of technology is exposed more often than anyone intends, and that the exposure is quiet until it is not.
The five questions above are worth asking whether or not anything is wrong. For practices working through the HIPAA side of this, the documented risk analysis and named Security Official are where the written record starts, and the HIPAA and IT overview for physician and dental practices covers what that looks like in a small office.
Practices that want a starting point can run the free email exposure scan, which reads public DNS records and returns results in seconds.